• TheGingerNut@piefed.blahaj.zoneEnglish
    118·
    10 days ago

    10.0.0.0/8 address space with a gateway address that gets randomized every 24 hours. Tomorrow’s address is advertised on a HTTP server local to the network that cannot be externally accessed. For security reasons.

    • BluescreenOfDeath@lemmy.worldEnglish
      45·
      10 days ago

      Nothing advertises hostnames, and the DHCP table is dumped and every client gets new address at the same time, too.

      Just make sure the MAC addresses randomize, too, and then you’ve got yourself a proper fucking mess for a hacker to sort out.

        • stoy@lemmy.zipEnglish
          3·
          7 days ago

          I have never found the number 69 joke/reference funny, just annoying.

          You are very welcome to use that IP adress yourself, but I am going to stick to 10.13.37.42

  • Cort@lemmy.world
    54·
    10 days ago

    Gateway is .69

    Dhcp is .70 - .254

    Static routes are .68 and below

    I will not be taking any questions

      • cynar@lemmy.worldEnglish
        8·
        10 days ago

        My guess is that enough people were buying routers and using them as access points. They all tend to be on 192.168.0.1 .254 means you don’t get as bad collisions when that happens. It would cut down on technical support calls.

      • shalafi@lemmy.worldEnglish
        4·
        10 days ago

        My new fibre modem is .254. It was a bitch to get into (whatever the mode’s called that makes it a simple gateway).

    • moodoovoodoo@lemmy.world
      6·
      10 days ago

      I work for a French company that does this, I don’t know if all French companies do this, but it threw me for a loop for sure.

    • chronicledmonocle@lemmy.world
      2·
      10 days ago

      There are reasons to put it at the end. For example, 192.168.1.254/24 can be expanded to /23 and have the same gateway address while you migrate clients that are statically assigned or while waiting on DHCP leases to expire, since /23 is a supernet of /24.

      • pepeSilvia@lemmy.dbzer0.comEnglish
        1·
        10 days ago

        What am I missing here?

        192.168.1.1/24 would also be a valid gateway for a /23, with the benefit of not having a gateway in the middle of your /23 network?

        I feel like this example is a greater justification for putting the gateway on the network/CIDR + 1, like a civilized person.

        • chronicledmonocle@lemmy.world
          1·
          10 days ago

          I shared another post here with how subnetting works. Basically, if you start with 192.168.1.254 on a /24 for your gateway and move to a /23, your usable range goes from 192.168.1.1-192.168.1.254 to 192.168.0.1-192.168.1.254.

          In this situation, the gateway address stays the same and since the /24 is contained within the /23, they can still connect to the gateway and keep working while you migrate things. The only thing they cannot talk to is clients in the 192.168.0.0/24 space until they pull new DHCP or have their static address updated. As such, it can make future expansion easier, if necessary.

          If you used 192.168.1.1/24 as the gateway initially, you’ll notice that in this same expansion plan it’s now smack in the middle of the subnet in a /23. Is that the end of the world? No, but it looks like shit and complicates things if you did something like I usually do and allocate certain “sections” of the subnet to non-DHCP space. Also, now you need to manage two DHCP pools, one below 192.168.1.1 and one above it. It’s one of those small things that compounds with each bandaid until you’re dying by a thousand cuts.

          I’m theory you would design your network with a large enough subnet from the get-go for expansion, but sometimes you screw up, so habits like this can make those screw ups less painful.

          • pepeSilvia@lemmy.dbzer0.comEnglish
            1·
            9 days ago

            Bleh, gotchu, I was getting the bit boundary wrong (192.168.0.0/24 > 192.168.0.0/23; NOT 192.168.1.0. that’s not how bits work)

    • xylogx@lemmy.worldEnglish
      2·
      10 days ago

      A typical ip address scheme is to assign lower blocks to dhcp pools and reserve high ip addresses to servers and network gear. Anything over 250 is typically a switch or a router in this case.

    • purplemonkeymad@programming.dev
      18·
      10 days ago

      Wait is there an existing unicode to ipv6 method. I assume it would just be the bit values of the emoji in utf8?

      fe80::“hello 🐔” aka fe80::6865:6c6c:6f20:f09f:9094

      I approve of the idea of cursed ipv6 notation.

        • FE80@lemmy.worldEnglish
          2·
          10 days ago

          I’ll be everywhere…wherever you look. Wherever there’s a fight so hungry people can eat, I’ll be there. Wherever there’s a cop beatin’ up a guy, I’ll be there. I’ll be in the way guys yell when they’re mad…I’ll be in the way kids laugh when they’re hungry and they know supper’s ready. And when our folks eat the stuff they raise and live in the houses they build…I’ll be there.

  • toynbee@lemmy.world
    27·
    10 days ago

    I used to use 1.2.3.4 as my gateway.

    At the time I didn’t understand why this offended … Basically everybody.

        • chronicledmonocle@lemmy.world
          10·
          9 days ago

          That’s mostly because it violates established standards, but you know that already. Lol.

          Also, if you’re talking to a network engineer, they probably have PTSD dealing with a client that did this with a 1.0.0.0/8 used internally or some shit and now huge swathes of the internet doesn’t work, but somehow it’s “our fault” that they can’t load random web sites.

          • toynbee@lemmy.world
            6·
            9 days ago

            Fwiw, I now use 10.10.220.0/24. I now know what class A, B and C are. I didn’t then.

            Hopefully that offers you some comfort.

            • jj4211@lemmy.world
              4·
              9 days ago

              Everyone knows you need to be using a network like fd25:c74c:a5e9::/64. So much more fun that way.

                • jj4211@lemmy.world
                  3·
                  9 days ago

                  It’s just a ‘proper’ IPv6 private address, the IPv6 equivalent of ‘10.’.

                  I say proper as a private address in ipv6 is supposed to be fd, then 40 random bits, then whatever you want. Nothing stops you from having fd::/64 as your private network though. The thinking was people who got tired of merging networks that happened to choose the same 10.x.x.x scheme and/or vpn connecting to multiple sites similarly with the same private address. So they thought it would be swell if every private network on earth would likely be unique, so they said you ‘must’ randomize 5 bytes of it. Then no renumbering/no conflicting vpn connections.

            • Billegh@lemmy.world
              2·
              7 days ago

              Thankfully, the internet is now as classless as I am. I don’t miss having to align to those.

          • jj4211@lemmy.world
            4·
            9 days ago

            That’s mostly because it violates established standards, but you know that already. Lol.

            Hey, for all you know he might actually be the proper owner of that subnet…

            I know if by some crazy coincedence I had that in my subnet I’d be using it for fun.

            • chronicledmonocle@lemmy.world
              4·
              9 days ago

              I recently had a ticket for a university that had a /12 of public IPs. They gave every computer, printer, etc. a public IP on their whole network. Nothing has NAT. It was insane. They could buy an entire other university building with the money they’d make selling some of that address space down to even a /24.

  • signalsayge@infosec.pubEnglish
    21·
    10 days ago

    I love that people forget about 127.0.0.0/8 being the loopback network. Everyone just uses .1 when there are so many to choose from.

    • lawks@aussie.zone
      7·
      9 days ago

      IPv6: Fuck you, you’re only allowed one, now. Yeah, yeah, I know there are about 340 undecillion addresses in the space, but I know better than you, no one in history has ever needed to bind different services to the same port on the loopback interface, and if they did they were doing it wrong. Oh you made an RFC draft? Well I let the one from 2015 2012 expire, so good luck with your current proposal, pleb.

        • lawks@aussie.zone
          5·
          10 days ago

          So the onus is on every individual user, to pick a random ULA prefix, bind specific addresses from it to the loopback interface, which is a different procedure for different OSes, probably requires root or elevated privileges, can have hard limits on, document it, etc. Greeeeaaaaaaat design. IPv6 gives out /64 like they’re about to turn bad, but can’t spare a /104? Gimme a break.

          I can dig a hole with a spoon, too, but if someone made it so that no one was allowed to dig holes with shovels unless they build their own (and have permission to build the shovel), when previously everyone was allowed to dig with shovels, I would not think highly of that person’s wisdom.

          Maybe you think G. Huston of APNIC and W. Kumari of Google don’t really know what they’re talking about?

          • chronicledmonocle@lemmy.world
            4·
            9 days ago

            I don’t bother with ULA addresses on my home network and just use the public /56 I have broken into various /64s for each VLAN I have. In a corporate environment, I might use ULA addresses, but since IPv6 is “everything is public by design” and an Enterprise will have a static IPv6 block, if they did it right, it’s not like it’ll change. And for anything that doesn’t need internet, link-local is a thing.

            IPv6 isn’t perfect, but I find myself liking it more and more as time goes on. Some of it is habits. Some of it is that I tire of dealing with things like CGNAT and SIP.

    • Aceticon@lemmy.dbzer0.comEnglish
      6·
      10 days ago

      People also commonly do not know that the reserved for intranet ip address range of 192.168.0.0 is actually /16 so you can pick any number between 0 and 255 for that 3rd byte and have their whole network in a range other that 192.168.0.0/8 like pretty much everybody else.

      • jj4211@lemmy.world
        4·
        9 days ago

        I have had to deal with a lot of companies where they did the opposite, acted like 192 was a /8 and did stuff way out of the private range.

    • recursivethinking@lemmy.world
      6·
      9 days ago

      According ding the the law of minimal keystrokes, there’s actually only 9 to choose from.

      After applying the law of minimal motion, you’re down to even fewer.

      Then you go a step further to just using 127.1 (or your preferred last digit)

  • hansolo@lemmy.today
    19·
    10 days ago

    My home server is at 192.168.1.230 because that’s what IP was assigned to the machine at the moment I set it up.

    Yep. Love that chaos, ya know?

  • notabot@piefed.socialEnglish
    13·
    10 days ago

    Nah, put your gateway in a different subnet, but on the same network segment, and add a static /32 route to it on every client.

    • cheet@infosec.pub
      2·
      10 days ago

      Is there a specific reason behind this? Never considered it but I could see it being useful since most specific routes win.

      • notabot@piefed.socialEnglish
        5·
        9 days ago

        Mostly to make the next sysadmin (or yourself in 6 months) weep. There’s nothing preventing there being multiple IP subnets on a single network segment, but you’d usually handle that with separate VLANs, or at least an interface alias, so the machine saw both subnets. About the only reason I could see for just adding a static route would be if you’re in the middle of reconfiguring your network to a new subnet but you still need the hosts you haven’t updated to be able to route.

        • jj4211@lemmy.world
          3·
          9 days ago

          The real nightmare when someone puts two ip addresses on the same host through different interfaces. Now that makes for some confusing troubleshooting and explanations in various applications.

          What really gets me is in about 3/4 networks in the last couple of weeks I’ve been asked to help troubleshoot, the problem has been duplicate IP addresses. I don’t know what is going on with people…

    • chronicledmonocle@lemmy.world
      1·
      9 days ago

      That won’t work, unless I’m misunderstanding you. You’d still need a gateway within your subnet to handle inter-subnet routing or an additional address on the gateway network.

      • jj4211@lemmy.world
        5·
        9 days ago

        It can be made to work, just really really stupid.

        Ultimately the ‘gateway’ is really a mac address, and the IP is just the thing to ARP to get the mac address. And you can do some gnarly things to pull off things like off-subnet gateway addresses.

        You should never ever do it, but you can if you hate yourself enough.

        Becomes easier in IPv6 to do these shenigans too.

        • chronicledmonocle@lemmy.world
          2·
          9 days ago

          Technically, sure, but you have to do a ton of fuckery and I have no idea why anybody would do all that work rather than just use an IP in the subnet.

      • notabot@piefed.socialEnglish
        3·
        9 days ago

        By adding a host, or /32, route to the gateway you should then be able to use it as the default gateway on your main subnet. I was not being serious when I suggested it, as another comment says, it’s a pretty stupid idea, and there really isn’t any sane usecase for it, except possibly one of those 1am “if it’s stupid but it works it’s still stupid, but it’ll do until morning” type fixes that you shudder to recall years later.

  • db2@lemmy.world
    12·
    10 days ago

    Also change the random address daily without announcing it. If the 7th floor wants internet they can damn well work for it. 😆

  • shalafi@lemmy.worldEnglish
    9·
    10 days ago

    10.10.10.70 here. There was a reason in the distant past that I did this and now it’s stuck that way forever.

    • gastroglizzy@piefed.socialEnglish
      10·
      10 days ago

      My soho setup is:

      1-100 = DHCP

      101 = Default gateway

      102 - 199 = Unused

      201-254 = Static, manually assigned IPs (if any)

      I came up with it before I got my Net+. I told myself I’d change it as soon as it caused any problems. That was 12 years ago.

      • Midnight Wolf@lemmy.worldEnglish
        2·
        10 days ago

        Mine is 1 for router/gateway, 2-199 is static with 2-9 (technically 1-9) being network gear, 10-19 being servers/related, 20-29 computers, 30-39 phones… all the way up to 100-119 for cameras and access, currently. And then 200+ for dhcp.

        Everything on the network runs dhcp but gets a static ip from the router. If I ever forget to assign a new device, it’s obvious since it won’t be near the related equipment, and it’ll be like 213 or something, sticking out like a sore thumb.

      • j3tt@lemmy.world
        1·
        10 days ago

        .1 gateway .2-.99 static range .100-.254 dynamic range (dhcp)

        btw. /23 networks are cool, too.

    • mlg@lemmy.worldEnglish
      7·
      10 days ago

      DHCP first is unhinged bruh

      1-127 is static, DHCP starts at 128.

      Libvirt/QEMU agrees with me so I must be right

    • nitrolife@hikki.team
      6·
      10 days ago

      I set the gateway to .1 and everything up to 100 I move out of DHCP into static pool for some nodes (speakers, servers, gateways, SIP phones, access points, switches, printers, vacuum cleaners, etc.). Simply because in this case, you have to type fewer digits to log into these boxes.

            • hylobates@jlai.luOP
              8·
              10 days ago

              I’m quite fond of 10.0.0.0/8. That gives you a lot of wiggle room, just in case.

            • Lodespawn@aussie.zoneEnglish
              4·
              10 days ago

              Well technically a 10. network could be a /8 if you really wanted to. But in this case the /23 was specified above. I don’t think it’s necessary but that’s what op was talking about and the 212.255 is a valid address, as is 213.0

              • BluescreenOfDeath@lemmy.worldEnglish
                3·
                10 days ago

                Sure, you could. But you’d be going out of your way to setup an internal IP scope you’ll never fully utilize.

                I suppose it doesn’t really matter, but it just feels wrong.

                • remotelove@lemmy.ca
                  2·
                  10 days ago

                  Thanks for the correction on the the broadcast address, btw. The details are important.

                  At home, I have 172.16/12 scoped out for my cluster subnet and just use the second and third octet to denote service function. It’s excessive scoping, but it’s an internal scope for a private network and broadcasts are generally contained to the cluster network. It would be trivial to split that into a 172.16/16 if I ever had the desire. (Speaking bluntly, it really doesn’t matter much in this case. I’ll need to split it out to keep Longhorn traffic segregated later, but it’s not an issue now.)

                  The rest of the network is reasonably scoped out across 192.168 ranges and chopped up across a few VLANs.

                  My addressing scheme is split into “public” and “stay the fuck out”, with most 172 addresses being the latter. At home this is great. In a large network, scoping out such a large 172 subnet could be detrimental. (“It depends” on the detrimental bit and requires proper planning and understanding about why subnets were even built into IPv4 from the get-go.)

                  Edit: Most addressing is static on my cluster network, with DHCP only handing out addresses based on MAC address. The 172 subnet has very restricted dynamic IP ranges.

                  Regardless of what is what, it’s a scheme I recognize and that is the more important bit.

                • draeath@lemmy.sdf.orgEnglish
                  2·
                  10 days ago

                  It might also make you really grumpy if you decide to use a VPN or containers - those often use 10/24 subnets and having an overlap with your LAN can make things spicy.

                • Lodespawn@aussie.zoneEnglish
                  1·
                  10 days ago

                  Yeah that’s fair. Maybe OP is planning a nonsense amount of IoT devices and cameras? or they just want to use some unorthodox IPs like .255 or .0 for fun 🤷

            • SpaghettiMaster@feddit.uk
              3·
              10 days ago

              I could see something like /20 being useful not so much for the number of addresses but to group things by use case, then /8 because you don’t care and it doesn’t matter. Also 10.0 is quicker to type and cleaner to look at than 192.168

          • Onomatopoeia@lemmy.cafeEnglish
            3·
            10 days ago

            I had students like you when teaching Cisco classes…

            Their peers heads would always explode, lol.

            • zurohki@aussie.zoneEnglish
              3·
              10 days ago

              If you use a /23 you can use the middle .0 too.

              My favourite dumb networking trick though is that Linux lets you use an IPv6 address as an IPv4 gateway.

              ip -4 route add default via inet6 fe80::1 dev eth0

              That works so long as the gateway is running dual stack.